Latest / Daily DefSec Brief / PHP critical fixes after a leak, eMudhra CA keys, SafePay ransomware | Cyber Security News Oct 21
Transcript
- Jerry: Migrations tend to leave a test account behind for a cleanup later. Later can take a long time. This is the daily DefSec brief for Wednesday, October 21st, 2026. If you only do one thing today, Find every server running PHP and patch it when the fix lands. one. No confirmed attacks yet, but PHP is fixing two critical flaws in the language itself today. Reports describe both as remote code execution. Their release is due at ten AM. Eastern. Information about the flaws leaked early and PHP moved their release up a day. You'll see headlines calling it a zero day. So far it's just a leak. One security vendor says attacks have started and the others haven't seen any. Find every copy of PHP run, including the ones inside vendor software and control panels. Older PHP versions may not get a fix. Plan to take those off the internet. Number two. No attacks yet, but a certificate authority called e-Mudhra had eight signing keys anyone could guess. One of them was the number four. Your bank card's pin has four digits. This key had one. With six of those keys, an attacker can sign a certificate for any website. Firefox, Chrome, and Apple have already blocked them. Go has a fix, but Go programs need rebuilding to get it. Anything that keeps its own list of trusted certificates may still trust them until it's updated. Update the CA bundles outside of your browsers. Three. Since August 2024 on Four Continents, the SafePay ransomware crew has hit at least 600 organizations. They get in by guessing passwords and through old flaws in Cisco ASA, SonicWall, and Veeam. Once inside, they reset NAS boxes to factory settings and sometimes delete network backups, require MFA on every VPN login. Consider keeping one backup offline because they go after the backups they can reach. Four, an attacker used a contributor's hijacked GitHub account to swap OVH Cloud's command line tool for a secret stealer. The bad download stayed online for about an hour and a half on Monday, October 19th. GitHub's release immutability setting was off on the project. That let one account change releases already published, skipping the project's checks. Turn on release immutability for your own repositories. 5. Attackers stole more than 3 million environment variables from Zeabur a hosting platform for developers. After its second breach in two months, the platform will close by the end of this year. The attackers used admin tokens that were set to never expire. Zeabur left those out when it rotated credentials after the first breach. If you deployed there, rotate every secret you've stored on Zeabur Rotating credentials works better when you include the admin ones. 6. No attacks yet, but a malicious MCP server can run code on Windows machines running the AI coding agent OpenCode. OpenCode fixed it in late September in a new version with no CVE and no advisory. That means vulnerability scanners won't flag the old installs. The vendor said malicious MCP servers are outside its threat model. Upgrade open code on your Windows developer machines. Seven, no attacks yet, but Chrome 156 fixes more than 350 security flaws, six of them critical. Push the update and force the restart. By the way, that's the tenth Chrome item on this show since July. Eight, Oracle fixed about twelve hundred flaws across thirty three product families In this week's quarterly update. Over a hundred of the fusion middleware ones may be open to anyone who can reach the server. Patch Fusion Middleware and eBusiness Suite first, Then clear your calendar for the rest. Nine, A ransomer crew got into a Welsh public sector data agency in 2024 through a test account called Test2. The agency's IT provider created that account in 2012 and gave it the password Password1 The local admin accounts on three servers also shared one password. That let the intruder move between them. This week, over the forgotten account and the shared password, the UK's privacy regulator reprimanded both organizations disable accounts that haven't signed in for a year. If deleting your old test accounts is on the list for later, this is later. Once more, find every copy of PHP You Run, grab some snacks, and start mashing the F5 key on PHP's website like everyone else. Thanks for watching, sources are in the show notes. If the show helps, like it, subscribe, and share it with a friend and use it. We'll be back again tomorrow.